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Abstract 



^ \ The problem of error control in random linear network coding is addressed from a matrix perspective 

that is closely related to the subspace perspective of Kotter and Kschischang. A large class of constant- 
dimension subspace codes is investigated. It is shown that codes in this class can be easily constructed 
from rank-metric codes, while preserving their distance properties. Moreover, it is shown that minimum 
distance decoding of such subspace codes can be reformulated as a generalized decoding problem for 

O . rank-metric codes where partial information about the error is available. This partial information may 

be in the form of erasures (knowledge of an error location but not its value) and deviations (knowledge 

^ ' of an error value but not its location). Taking erasures and deviations into account (when they occur) 

00 , 

f~^ \ strictly increases the error correction capabihty of a code: if ^i erasures and 5 deviations occur, then 



errors of rank t can always be corrected provided that 2i<(i— l + /i + (5, where d is the minimum rank 
distance of the code. For Gabidulin codes, an important family of maximum rank distance codes, an 



r — ' efficient decoding algorithm is proposed that can properly exploit erasures and deviations. In a network 

^~^ ' coding application where n packets of length M over Fg are transmitted, the complexity of the decoding 



algorithm is given by 0{dM) operations in an extension field F^n. 
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I. Introduction 

While random linear network coding [l]-[3] is an effective technique for information dissemination 
in communication networks, it is highly susceptible to errors. The insertion of even a single corrupt 
packet has the potential, when linearly combined with legitimate packets, to affect all packets gathered 
by an information receiver. The problem of error control in random network coding is therefore of great 
interest. 

In this paper, we focus on end-to-end error control coding, where only the source and destination nodes 
apply error control techniques. Internal network nodes are assumed to be unaware of the presence of an 
outer code; they simply create outgoing packets as random linear combinations of incoming packets in 
the usual manner of random network coding. In addition, we assume that the source and destination nodes 
have no knowledge — or at least make no effort to exploit knowledge — of the topology of the network 
or of the particular network code used in the network. This is in contrast to the pioneering approaches 
[4]-[6], which have considered the design of a network code as part of the error control problem. 

In the basic transmission model for end-to-end coding, the source node produces n packets, which are 
length-M vectors in a finite field ¥g, and the receiver gathers N packets. Additive packet errors may 
occur in any of the links. The channel equation is given by y = AX + BZ, where X, Y and Z are 
matrices whose rows represent the transmitted, received and (possibly) corrupting packets, respectively, 
and A and B are the (unknown) corresponding transfer matrices induced by linear network coding. 

There have been three previous quite different approaches to reliable communication under this model. 
In [7], Zhang characterizes the error correction capability of a network code under a brute-force decoding 
algorithm. He shows that network codes with good error-correcting properties exist if the field size is 
sufficiently large. His approach can be applied to random network coding if an extended header is 
included in each packet in order to allow for the matrix B (as well as ^4) to be estimated at a sink node. 
A drawback of this approach is that the extended header has size equal to the number of network edges, 
which may incur excessive overhead. In addition, no efficient decoding algorithm is provided for errors 
occurring according to an adversarial model. 

Jaggi et al. [8] propose a different approach specifically targeted to combat Byzantine adversaries. 
They provide rate-optimal end-to-end codes that do not rely on the specific network code used and that 
can be decoded in polynomial time. However, their approach is based on probabilistic arguments that 
require both the field size and the packet length to be sufficiently large. 

In contrast, Kotter and Kschischang [9] take a more combinatorial approach to the problem, which 



provides correction guarantees against adversarial errors and can be used with any given field and packet 
size. Their key observation is that, under the unknown linear transformation applied by random network 
coding, the only property of the matrix X that is preserved is its row space. Thus, information should 
be encoded in the choice of a subspace rather than a specific matrix. The receiver observes a subspace, 
given by the row space of Y, which may be different from the transmitted space when packet errors 
occur. A metric is proposed to account for the discrepancy between transmitted and received spaces, and 
a new coding theory based on this metric is developed. In particular, nearly-optimal Reed-Solomon-like 
codes are proposed that can be decoded in 0{nM) operations in an extension field Fg^. 

Although the approach in [9] seems to be the appropriate abstraction of the error control problem in 
random network coding, one inherent difficulty is the absence of a natural group structure on the set of all 
subspaces of the ambient space F^^. As a consequence, many of the powerful concepts of classical coding 
theory such as group codes and linear codes do not naturally extend to codes consisting of subspaces. 

In this paper, we explore the close relationship between subspace codes and codes for yet another 
distance measure: the rank metric. Codewords of a rank metric code are n x m matrices and the rank 
distance between two matrices is the rank of their difference. The rank metric was introduced in coding 
theory by Delsarte [10]. Codes for the rank metric were largely developed by Gabidulin [11] (see also 
[10], [12]). An important feature of the coding theory for the rank metric is that it supports many of 
the powerful concepts and techniques of classical coding theory, such as linear and cyclic codes and 
corresponding decoding algorithms [11]-[14]. 

One main contribution of this paper is to show that codes in the rank metric can be naturally "lifted" to 
subspace codes in such a way that the rank distance between two codewords is reflected in the subspace 
distance between their lifted images. In particular, nearly-optimal subspace codes can be obtained directly 
from optimal rank-metric codes. Conversely, when lifted rank-metric codes are used, the decoding problem 
for random network coding can be reformulated purely in rank-metric terms, allowing many of the tools 
from the theory of rank-metric codes to be applied to random network coding. 

In this reformulation, we obtain a generalized decoding problem for rank-metric codes that involves 
not only ordinary rank errors, but also two additional phenomena that we call erasures and deviations. 
Erasures and deviations are dual to each other and correspond to partial information about the error 
matrix, akin to the role played by symbol erasures in the Hamming metric. Here, an erasure corresponds 
to the knowledge of an error location but not its value, while a deviation correspond to the knowledge of 
an error value but not its location. These concepts generalize similar concepts found in the rank-metric 
literature under the terminology of "row and column erasures" [13], [15]-[18]. Although with a different 



terminology, the concept of a deviation (and of a code that can correct deviations) has appeared before 
in [19]. 

Our second main contribution is an efficient decoding algorithm for rank-metric codes that takes into 
account erasures and deviations. Our algorithm is applicable to Gabidulin codes [11], a class of codes, 
analogous to conventional Reed-Solomon codes, that attain maximum distance in the rank metric. We 
show that our algorithm fully exploits the correction capability of Gabidulin codes; namely, it can correct 
any pattern of e errors, ^ erasures and 6 deviations provided 2e + ^ + 6 < d—1, where d is the minimum 
rank distance of the code. Moreover, the complexity of our algorithm is 0{dM) operations in Fgn, which 
is smaller than that of the algorithm in [9], especially for practical high-rate codes. 

In the course of setting up the problem, we also prove a result that can be seen as complementary 
to [9]; namely, we relate the performance guarantees of a subspace code with more concrete network 
parameters such as the maximum number of corrupting packets that can be injected in the network. This 
result provides a tighter connection between the subspace approach of [9] and previous approaches that 
deal with link errors. 

The remainder of this paper is organized as follows. In Section JIl we provide a brief review of rank- 
metric codes and subspace codes. In Section |llll we describe in more detail the problem of error control 
in random network coding, along with Kotter and Kschischang's approach to this problem. In Section [TVl 
we present our code construction and show that the resulting error control problem can be replaced by a 
generalized decoding problem for rank-metric codes. At this point, we turn our attention entirely to rank- 
metric codes. The generalized decoding problem that we introduce is developed in more detail in Section 
rvl wherein the concepts of erasures and deviations are described and compared to related concepts in 
the rank-metric literature. In Section IVll we present an efficient algorithm for decoding Gabidulin codes 
in the presence of errors, erasures and deviations. Finally, Section IVIII contains our conclusions. 

II. Preliminaries 
A. Notation 

Let g > 2 be a power of a prime. In this paper, all vectors and matrices have components in the finite 
field Fg, unless otherwise mentioned. We use F^ ^'" to denote the set of all n x m matrices over Fg and 
we set F" = F"^^. In particular, v € F" is a column vector and f G F^^™ is a row vector. 

If t> is a vector, then the symbol vi denotes the ith entry of v. If j4 is a matrix, then the symbol Ai 
denotes either the ith row or the ith column of A; the distinction will always be clear from the way 



in which A is defined. In either case, the symbol Ay always refers to the entry in the ith row and jth 
column of A. 

For clarity, the k x k identity matrix is denoted by Ikxk- If we set / = /„xn, then the notation li will 
denote the ith column of /. More generally, if Z// C {1, . . . ,n}, then lu = [/«, i ^ U] will denote the 
sub-matrix of / consisting of the columns indexed by U. 

The linear span of a set of vectors vi, . . . ,Vk is denoted by {vi, . . . ,Vk)- The row space, the rank and 
the number of nonzero rows of a matrix X are denoted by {X), rank X and wt(X), respectively. The 
reduced row echelon (RRE) form of a matrix X is denoted by RRE(X). 



B. Properties of Matrix Rank and Subspace Dimension 

Let X G Fg^"*. By definition, rankX = dim (X); however, there are many useful equivalent 
characterizations. For example, rankX is the smallest r for which there exist matrices A G JT'^X'' and 
B € F^^™ such that X = AB, i.e., 

rank X = 



mm 

X=AB 



It is well-known that, for any X, y G F^^™, we have 

rank(X + Y) < rank X + rank Y 
and that, for X G F^^™ and A G F^^", we have 

rank(AX) > rank A + rank X - n. 
Recall that if U and V are subspaces of some fixed vector space, then the sum 

U + V = {u + v: ueU,veV} 
is the smallest subspace that contains both U and V . Recall also that 

6\m{U + V) = dim U + 6\mV - 6\m{U r\V). 



We will make extensive use of the fact that 

X 



Y 



(X) + {Y) 



and therefore 



rank 



dim((X) + (y)) 

rank X + rank Y - dim ((X) n (Y)). 



(1) 



(2) 



(3) 



(4) 



(5) 



(6) 



C. Rank-Metric Codes 

A matrix code is defined as any nonempty subset of F^ ^™. A matrix code is also commonly known 
as an array code when it forms a linear space over ¥q [12]. 

A natural and useful distance measure between elements of F"^™ is given in the following definition. 

Definition 1: For X,Y ^ ^nxm^ jj^g ^^^^^ distance between X and Y is defined as df^{X,Y) = 
rank(y-X). 

As observed in [11], rank distance is indeed a metric. In particular, the triangle inequality for the rank 
metric follows directly from Q. In the context of the rank metric, a matrix code is called a rank-metric 
code. The minimum (rank) distance of a rank-metric code C c F^ ^™ is defined as 

d^{C) = min d^{x,x'). 

x,x'&C 

x^x' 

Associated with every rank-metric code C C F"^"^ is the transposed code C^ C F^^", whose 
codewords are obtained by transposing the codewords of C, i.e., C'^ = {x^ : x G C}. We have |C^| = \C\ 
and dY^{C'^) = ds,{C). Observe the symmetry between rows and columns in the rank metric; the distinction 
between a code and its transpose is in fact transparent to the metric. 

A minimum distance decoder for a rank-metric code C C F"^"^ takes a word r G F" ^"^ and returns 
a codeword x ^C that is closest to r in rank distance, that is, 

X = argniin rank(r — a;). (7) 

x&C 

Note that if df,{x, r) < d^{C)/2, then a minimum distance decoder is guaranteed to return x = x. 

Throughout this paper, problem (|7]l will be referred to as the conventional rank decoding problem. 

There is a rich coding theory for rank-metric codes that is analogous to the classical coding theory in 
the Hamming metric. In particular, we mention the existence of a Singleton bound [10], [11] (see also 
[20] [21]), which states that every rank metric code C C Fg^'" with minimum distance d = d^{C) must 
satisfy 

logq \C\ < min{n(m — d + 1), m{n — d-\- 1)} 

= max{n,r7T,}(min{n,m} — d + 1). (8) 

Codes that achieve this bound are called maximum-rank-distance (MRD) codes. An extensive class of 
MRD codes with n < m was presented by Gabidulin in [11]. By transposition, MRD codes with n > m 
can also be obtained. Thus, MRD codes exist for all n and m and all d < min{n, m}, irrespectively of 
the field size q. 



D. Subspace Codes 

Let ■p(Fg^) denote the set of all subspaces of F^^. We review some concepts of the coding theory for 
subspaces developed in [9]. 

Definition 2: Let F, V G V{¥^). The subspace distance between V and V' is defined as 

ds{V,V') = (\\m{V + V') - d\m{V nV) 

= 26\m{V + V')-6\mV -A\mV' (9) 

= d\mV + 6\mV' -26\m{Vr\V'). (10) 

It is shown in [9] that the subspace distance is indeed a metric on V{¥q^). 

A subspace code is defined as a nonempty subset of V{¥q^). The minimum (subspace) distance of a 
subspace code $7 C ^'(F^"'^) is defined as 

dA9) = mill dAVy). 
^ ' v,v'&n ^ ^ 

The minimum distance decoding problem for a subspace code is to find a subspace V ^ Q that is 
closest to a given subspace U G V{¥^^), i.e., 

y = argmin ds(F,C/). (11) 

A minimum distance decoder is guaranteed to return V = V ii ds{V, U) < ds{^)/2. 

Let Vi^'^^ ,n) denote the set of all n-dimensional subspaces of F^^. A subspace code Q. is called a 
constant-dimension code if fi C 'P(F^'^,n). It follows from ^ or ( jTOb that the minimum distance of a 
constant-dimension code is always an even number. 

Let Aq [M, 2d, n] be denote the maximum number of codewords in a constant-dimension code with 
minimum subspace distance 2d. Many bounds on Aq[M,2d,n] were developed in [9], in particular the 

Singleton-like bound 

M-d+1 

max{n, M — n\ 



Aq[M,2d,n] < 
where 



(12) 



n 



A jq^' - 1) ■ ■ ■ (g"^-"+^ - 1) 

, (gn-l)...(g-l) 



denotes the Gaussian coefficient. It is well known that the Gaussian coefficient gives the number of 
distinct n-dimensional subspaces of an M-dimensional vector space over Fg, i.e., [^] = \V{¥q^ ,n)\. 



A useful bound on [ ,^ ] is given by [9, Lemma 5] 

^4^n{M-n)^ (13) 



'M 
n 

Combining (IT2l ) and (IT3] ) gives 
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^g[M, 2d, n] < 4gmax{n,A/-n}(mm{n,M-n}-d+l)^ ^^4^ 

There exist also bounds on Aq[M, 2d, n] that are tighter than (IT2l ). namely the Wang-Xing-Safavi-Naini 
bound [22] and a Johnson-type bound [23]. 

For future reference, we define the sub-optimality of a constant-dimension code C 'P(Fg^,n) with 
ds(r2) = 2(i to be 

"^ ^" log,A[M,2d,n] • ^''^ 

III. Error Control in Random Network Coding 
A. Channel Model 

We start by reviewing the basic model for single-source generation-based random linear network 
coding [2], [3]. Consider a point-to-point communication network with a single source node and a single 
destination node. Each link in the network is assumed to transport, free of errors, a packet of M symbols 
in a finite field F^. Links are directed, incident from the node transmitting the packet and incident to 
the node receiving the packet. A packet transmitted on a link incident to a given node is said to be an 
incoming packet for that node, and similarly a packet transmitted on a link incident from a given node 
is said to be an outgoing packet for that node. 

During each transmission generation, the source node formats the information to be transmitted into n 
packets Xi, . . . , Xn G F^^^^, which are regarded as incoming packets for the source node. Whenever a 
node (including the source) has a transmission opportunity, it produces an outgoing packet as a random 
Fg-linear combination of all the incoming packets it has until then received. The destination node collects 
N packets li, . . . , Y^r € F^^^^ and tries to recover the original packets Xi, . . . , X„. 

Let X be an n X M matrix whose rows are the transmitted packets Xi , . . . , X„ and, similarly, let 
y be an X X M matrix whose rows are the received packets Yi, . . . , Y^. Since all packet operations 
are linear over ¥q, then, regardless of the network topology, the transmitted packets X and the received 
packets Y can be related as 

Y = AX, (16) 

where A is an X x n matrix corresponding to the overall linear transformation applied by the network. 



Before proceeding, we remark that this model encompasses a variety of situations: 

• The network may have cycles or delays. Since the overall system is linear, expression (fT6l ) will be 
true regardless of the network topology. 

• The network could be wireless instead of wired. Broadcast transmissions in wireless networks may 
be modeled by constraining each intermediate node to send exactly the same packet on each of its 
outgoing links. 

• The source node may transmit more than one generation (a set of n packets). In this case, we assume 
that each packet carries a label identifying the generation to which it corresponds and that packets 
from different generations are processed separately throughout the network [2]. 

• The network topology may be time-varying as nodes join and leave and connections are established 
and lost. In this case, we assume that each network link is the instantiation of an actual successful 
packet transmission. 

• The network may be used for multicast, i.e., there may be more than one destination node. Again, 
expression (fT6l ) applies; however, the matrix A may be different for each destination. 

Let us now extend this model to incorporate packet errors. Following [4]-[6], we consider that packet 
errors may occur in any of the links of the network. Suppose the Mnks in the network are indexed from 
1 to £, and let Zi denote the error packet applied at link i G {!,...,£}. The application of an error 
packet is modeled as follows. We assume that, for each link i, the node transmitting on that link first 
creates a prescribed packet Pjn j S jpixA/ following the procedure described above. Then, an error packet 
Zi G pixA^ is added to Pjn j in order to produce the outgoing packet on this link, i.e., Pout.i = Pin,i + Zi. 
Note that any arbitrary packet Pout,i can be formed simply by choosing Zi = Pout,i — Pin,i- 

Let Z he an £ X M matrix whose rows are the error packets Zi, . . . , Zi. By linearity of the network, 
we can write 

Y = AX + BZ, (17) 

where B is an N x £ matrix corresponding to the overall linear transformation applied to Zi , . . . , Z^ on 
route to the destination. Note that Zi = means that no corrupt packet was injected at link i. Thus, the 
number of nonzero rows of Z, wt(Z), gives the total number of (potentially) corrupt packets injected in 
the network. Note that it is possible that a nonzero error packet happens to be in the row space of X, in 
which case it is not really a corrupt packet. 

Observe that this model can represent not only the occurrence of random link errors, but also the 
action of malicious nodes. A malicious node can potentially transmit erroneous packets on all of its 
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outgoing links. A malicious node may also want to disguise itself and transmit correct packets on some 
of these links, or may simply refuse to transmit some packet (i.e., transmitting an all-zero packet), which 
is represented in the model by setting Zj = —P\n^i- In any case, wt(Z) gives the total number of "packet 
interventions" performed by all malicious nodes and thus gives a sense of the total adversarial "power" 
employed towards jamming the network. 

Equation (ITtI) is our basic model of a channel induced by random linear network coding, and we 
will refer to it as the random linear network coding channel (RLNCC). The channel input and output 
alphabets are given by F^^^^ and F^^^, respectively. To give a full probabilistic specification of the 
channel, we would need to specify the joint probabihty distribution of A, B and Z given X. We will 
not pursue this path in this paper, taking, instead, a more combinatorial approach. 

B. Transmission via Subspace Selection 

Let il C ■p(Fg^) be a subspace code with maximum dimension n. In the approach in [9], the source 
node selects a subspace F G and transmits this subspace over the RLNCC as some matrix X G FJ^^*^ 
such that V = {X). The destination node receives Y G F^^^^ and computes U = (Y), from which the 
transmitted subspace can be inferred using a minimum distance decoder (ITT]) . 

In this paper, it will be convenient to view the above approach from a matrix perspective. In order to 
do that, we simply replace Q by an (arbitrarily chosen) matrix code that generates 0. More precisely, let 
[n] = {X G F^^^^ : X = RRE(X), {X) G f^} be a matrix code consisting of all the nxM matrices in 
RRE form whose row space is in Q.. Now, the above setup can be reinterpreted as follows. The source 
node selects a matrix X G [^] to transmit over the RLNCC. Upon reception of Y, the destination node 
tries to infer the transmitted matrix using the minimum distance decoding rule 

X = argmin d,{{X) , (Y)). (18) 

xe[n] 

Note that the decoding is guaranteed to be successful if dsi{X) , (Y)) < ds{^)/2. 

C. Performance Guarantees 

In this subsection, we wish to relate the performance guarantees of a subspace code with more concrete 
network parameters. Still, we would Uke these parameters to be sufficiently general so that we do not 
need to take the whole network topology into account. 

We make the following assumptions: 

• The column-rank deficiency of the transfer matrix A is never greater than p, i.e., rank A > n — p. 



11 



• The adversarial nodes together can inject at most t corrupting packets, i.e., wt(Z) < t. 
The following result characterizes the performance guarantees of a subspace code under our assump- 
tions. 

Theorem 1: Suppose rank A> n — p and wt(Z) < t. Then, decoding according to (fTSl ) is guaranteed 
to be successful provided 2t + p < ds{^)/2. 

In order to prove Theorem [TJ we need a few results relating rank and subspace distance. 

Proposition 2: Let X,Y eF^""^ . Then 



rank 



< rank(y - X) + minjrank X, rank Y}. 



Proof: We have 



rank 



rank 



X 


= rank 


X 


Y 




Y-X 


X 


= rank 


Y-X 


Y 




Y 



< rank(y-X) + rankX 

< rank(y-X) + ranky. 



Corollary 3: Let X, Z gW^""^^ and Y = X + Z. Then 

ds{{X),{Y)) < 2 rank Z- | rank X - rank y|. 

Proof: From Proposition |2l we have 

X 



ds(W,(y)) = 2rank 



Y 



rank X — rank Y 



< 2 rank Z + 2min{rank X, ranky} 

— rank X — rank Y 
= 2 rank Z — I rank X — rank Y\. 



We can now give a proof of Theorem [T] 

Proof of Theorem [7} From Corollary [3l we have that 

ds{{AX) ,{Y)) < 2rank BZ < 2 rank Z < 2wt(Z) < 2t. 
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Using (|3]l, we find that 

ds{{X) , {AX)) = rank X - rank AX < n - rank A < p. 
Since ds{-,-) satisfies the triangle inequality, we have 

d,i{X) ,{¥))< d,i{X) , {AX)) + d,i{AX) , {¥)) 
< p + 2t 

and therefore the decoding is guaranteed to be successful. ■ 

Theorem [T] is analogous to Theorem 2 in [9], which states that minimum subspace distance decoding 
is guaranteed to be successful if 2(;U + 6) < ds{Q), where 6 and p are, respectively, the number of 
"insertions" and "deletions" of dimensions that occur in the channel [9]. Intuitively, since one corrupted 
packet injected at a network min-cut can effectively replace a dimension of the transmitted subspace, we 
see that t corrupted packets can cause t deletions and t insertions of dimensions. Combined with possible 
p further deletions caused by a row-rank deficiency of A, we have that 6 = t and p = t + p. Thus, 

S + p<^f^ =^ 2t + p<^^. 

In other words, under the condition that corrupt packets may be injected in any of the links in network 
(which must be assumed if we do not wish to take the network topology into account), the performance 
guarantees of a minimum distance decoder are essentially given by Theorem [T] 

It is worth to mention that, according to recent results [24], minimum subspace distance decoding may 
not be the optimal decoding rule when the subspaces in Q, have different dimensions. For the remainder 
of this paper, however, we focus on the case of a constant-dimension code and therefore we use the 
minimum distance decoding rule (fTSl) . Our goal will be to construct constant-dimension subspace codes 
with good performance and efficient encoding/decoding procedures. 

IV. Codes for the Random Linear Network Coding Channel Based on Rank-Metric 

Codes 

In this section, we show how a constant-dimension subspace code can be constructed from any rank- 
metric code. In particular, this construction will allow us to obtain nearly-optimal subspace codes that 
possess efficient encoding and decoding algorithms. 
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A. Lifting Construction 

From now on, assume that AI = n + m, where m > 0. Let / = /„xn- 



Definition 3: Let I: F^^™ -^ P(F^+™), given by cc h^ I{x) 



I X 



. The subspace I{x) is 



called the lifting of the matrix x. Similarly, if C C F"^'" is a rank-metric code, then the subspace code 
I{C), obtained by lifting each codeword of C, is called the lifting of C. 

Definition |3] provides an injective mapping between rank-metric codes and subspace codes. Note that 
a subspace code constructed by lifting is always a constant-dimension code (with codeword dimension 
n). 

Although the lifting construction is a particular way of constructing subspace codes, it can also be 
seen as a generalization of the standard approach to random network coding [2], [3]. In the latter, every 
transmitted matrix has the form X = [I x], where the pay load matrix x G ]p^x™ corresponds to the 
raw data to be communicated. In our approach, each transmitted matrix is also of the form X = [I x], 
but the payload matrix a; G C is restricted to be a codeword of a rank-metric code rather than uncoded 
data. 

Our reasons for choosing C to be a rank-metric code will be made clear from the following proposition. 

Proposition 4: Let C C F^^"* and x,x' eC. Then 

ds{I{x),I{x')) =2d^{x,x') 
d,{I{C)) = 24(C). 
Proof: Since dim I{x) = dim I{x') = n, we have 

ds{I{x),I{x')) = 2d\m{I{x)+I{x')) - 2n 

I X 



2 rank 



2 rank 



2n 



/ x' 

I X 

x' -X 



2n 



= 2 rank(a;' — x). 

The second statement is immediate. ■ 

Proposition |4] shows that a subspace code constructed by lifting inherits the distance properties of its 
underlying rank-metric code. The question of whether such lifted rank-metric codes are "good" compared 
to the whole class of constant-dimension codes is addressed in the following proposition. 
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Proposition 5: Let C C F^^™ be an MRD code with 4(C) = d. Then d^{T{C)) = 2d and 

Aq[n + m,2d,n\ < 4|J(C)| = 4|C|. 
Moreover, for any code parameters, the sub-optimaUty of Z(C) in ^(F"^™,/!) satisfies 

«mc)) < "" 



[n + ?Ti) log2 q 

Proof: Using (fT4l) and the fact that C achieves the Singleton bound for rank-metric codes ^, we 
have 

Aq[n + m, 2d, n] < 4gmax{n,m}(min{n,m}-d+l) 
= 4|C|. 

Applying this result in ( fTSl ). we obtain 

loe„4 
a(J(C)) < 



< 



maxjn, 7Ti}(niin{n, m} — d+\) 
loK„4 



max{n, m} 
loK^4 



^ og 



(n + m)/2 

4 
(n + m) log2 g 



Proposition |5] shows that, for all practical purposes, lifted MRD codes are essentially optimal as 
constant-dimension codes. Indeed, the rate loss in using a lifted MRD code rather than an optimal 
constant-dimension code is smaller than 4/P, where P = {n -\- m) log2 q is the packet size in bits. In 
particular, for packet sizes of 50 bytes or more, the rate loss is smaller than 1%. 

In this context, it is worth mentioning that the nearly-optimal Reed-Solomon-like codes proposed in 
[9] correspond exactly to the lifting of the class of MRD codes proposed by Gabidulin [11]. The latter 
will be discussed in more detail in Section IVTl 

B. Decoding 

We now specialize the decoding problem ( fTSl ) to the specific case of lifted rank-metric codes. We will 
see that it is possible to reformulate such a problem in a way that resembles the conventional decoding 
problem for rank-metric codes, but with additional side-information presented to the decoder. 
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Let the transmitted matrix be given hy X = [I x], where x ^ C and C C ]p"x™ is a rank-metric 
code. Write the received matrix as 

Y = [A y] 

where A G jr^x"^ and y € F^^™. In accordance with the formulation of Section UlI-BI we assume that 
rank y = iV, since any linearly dependent received packets do not affect the decoding problem and may 
be discarded by the destination node. Now, define 

fi = n — rank A and 5 = N — rank A. 

Here /x measures the rank deficiency of A with respect to columns, while 5 measures the rank deficiency 
of A with respect to rows. 

Before examining the general problem, we study the simple special case that arises when ^ = 6 = 0. 

Proposition 6: If i^i = 5 = 0, then 

d,{{X),{Y))=2d,(x,r) 

where r = A~^y. 

Proof: Since fi = 6 = 0, A is invertible. Thus, Y = [I Ar^y] is row equivalent to Y , i.e., 
(y) = (Y). Applying Proposition |4l we get the desired result. ■ 

The above proposition shows that, whenever A is invertible, a solution to (fTSl ) can be found by solving 
the conventional rank decoding problem. This case is illustrated by the following example. 

Example 1: Let n = 4 and q = 5. Let xi, . . . , X4 denote the rows of a codeword a; G C. Suppose that 

2 4 2 4 

3 3 

10 4 3 

4 14 



A 



B 



4 10 



and Z 



12 3 4 



Then 



Y 



1 2 4 2x1 + 4x2 + 2x3 + 4x4 + 4z 
3 3 3x3 + 3x4 

2 2 2 2 xi + 4x3 + 3x4 + z 
4 14 4x2 + X3 + 4x4 

Converting Y to RRE form, we obtain 

Y=\l r 



(19) 
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where 

3x2 + 2x3 + 2:4 + 2; 

3x1 + 2x2 + 4x3 + 2x4 + 2z 

4xi + 3x2 + 3x3 + X4 + z 

xi + 2x2 + 3x3 + Az 

Note that, if no errors had occurred, we would expect to find r = x. 

Now, observe that we can write 



Xi 




1 


X2 
X3 


+ 


2 
1 


X4 




4 



[4x1 



+ 3X2 + 2X3 + X4 + z 



Thus, rank(r — a;) = 1. We can think of this as an error word e = r — a; of rank 1 applied to x. This 
error can be corrected if djf,{C) > 3. ■ 

Let us now proceed to the general case, where A is not necessarily invertible. We first examine a 
relatively straightforward approach that, however, leads to an unattractive decoding problem. 
Similarly to the proof of Proposition [6l it is possible to show that 

ds{{X),{Y)) = 2rank{y-Ax)+fi-6 

which yields the following decoding problem: 



X = argmin rank(y — Ax), 
xec 



(20) 



If we define a new code C = AC = {Ax, tc € C}, then a solution to (l20l ) can be found by first solving 

x' = argmin rank{y — x') 
x'ec 

using a conventional rank decoder for C and then choosing any x ^ {x \ Ax = x'} as a solution. 

An obvious drawback of this approach is that it requires a new code C to be used at each decoding 

instance. This is likely to increase the decoding complexity, since the existence of an efficient algorithm 

for C does not imply the existence of an efficient algorithm for C = AC for all A. Moreover, even if 

efficient algorithms are known for all C , running a different algorithm for each received matrix may be 

impractical or undesirable from an implementation point-of-view. 

In the following, we seek an expression for d^{{X) , {¥)) where the structure of C can be exploited. In 

order to motivate our approach, we consider the following two examples, which generalize Example [T] 
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Example 2: Let us return to Example [T] but now suppose 



A 



1 





2 


3 


1 


3 





3 


1 


4 





3 


2 





4 





1 


1 


2 


4 



s 



4 10 



and Z 



1 2 3 4 2 



. Then 



3 4 4 xi + 2x3 + 3x4 + 4^ 
13 3 xi + 3x2 + 3x4 

Y = 2 1 3 2 xi + 4x2 + 3x4 + 2; = I i y 

2 4 2x1 + 4x3 

1 1 2 4 Xi + X2 + 2X3 + 4X4 

Although A is not invertible, we can nevertheless convert Y to RRE form to obtain 

/ r 



Y 



E 



(21) 



where 



and 



2x1 + 2x2 + 3x3 + 4x4 + 42; 

4xi + 4x2 + 2x3 + X4 + 2; 
2xi + 4x2 + 2x3 + 3x4 + 32; 
3xi + X2 + 4x3 + 3x4 + 22; 



E = 2xi + 4x2 + 2:3 + 3x4 + 32;. 



X 



E. 



Observe that 

xi + 2x2 + 3x3 + 4x4 + 42; 3 

4xi + 3x2 + 2x3 + X4 + z 2 

2xi + 4X2 + x^ + 3X4 + 32 1 

3X1 + X2 + 4X3 + 2X4 + 22 4 
Thus, we see not only that rank e = 1, but we have also recovered part of its decomposition as an outer 
product, namely, the vector E. ■ 
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Y 



A y 



Example 3: Consider again the parameters of Example [TJ but now let 

3 2 11 

A= 4 3 2 

2 10 4 
and suppose that there are no errors. Then 

3 2 11 3xi + 2x2 + X3 + x^ 
4 3 2 4x2 + 3x3 + 2x4 

2 10 4 2x1 + X2 + 4x4 

Once again we cannot invert A; however, after converting Y to RRE form and inserting an all-zero row 
in the third position, we obtain 

1 4 xi + 4x3 

1 2 X2 + 2X3 



1 X4 

10 4 xi + 4x3 
1 2 X2 + 2X3 

1-1 X3 - X3 

1 X4 
/ + L/J X + Lx3 

1 + LI^ r 



Y 



(22) 



where 



L 





Once again we see that the error word has rank 1 , and that we have recovered part of its decomposition 
as an outer product. Namely, we have 

e = r — X = Lx3 



where this time L is known. 
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Having seen from these two examples how side information (partial knowledge of the error matrix) 
arises at the output of the RLNCC, we address the general case in the following proposition. 



Proposition 7: Let Y , fi and 6 be defined as above. There exist a tuple (r,L,£')€F"^'"xFq '^xF; 



and a set Z// C {1, . . . , n} satisfying 







such that 



m 






luL 



rank E 



I + LI^ r 



-I. 



^Xfl 







E 



(Y) 



f'Sxm 
1 

(23) 
(24) 
(25) 
(26) 

(27) 



Proof: See the Appendix. 
Proposition |7] shows that every matrix Y is row equivalent to a matrix 

Y= 1^ + ^^" "^ 

E 

which is essentially the matrix Y in reduced row echelon form. Equations il9\i . (|2T1) and (I22|) are examples 
of matrices in this form. We can think of the matrices r, L and E and the set U as providing a compact 
description of the received subspace (Y). The set U is in fact redundant and can be omitted from the 
description, as we show in the next proposition. 

Proposition 8: Let {r,L,E) G F^^"* x Fg""^ x F^^"* be a tuple and Z^ C {1, . . . ,n} be a set that 
satisfy (l23l)-(l26l). For any cS C {1, . . . , n}, T € F^'''' and R € F^^-^ such that (r, LT, RE) and S satisfy 



23])-(l26b. we have 



/ + LTI'^ r 







RE 



I + Lll r 

E 



Proof: See the Appendix. ■ 

Proposition [8] shows that, given a tuple {r,L,E) obtained from Proposition |7j the set U can be found 
as any set satisfying (|23l)-(l25l). Moreover, the matrix L can be multiplied on the right by any nonsingular 
matrix (provided that the resulting matrix satisfies (l23])-(l25l) for some U), and the matrix E can be 
multiplied on the left by any nonsingular matrix; none of these operations change the subspace described 
by (r, L, E). The notion of a concise description of a subspace (Y) is captured in the following definition. 
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Definition 4: A tuple (r, L, E) € F" 



X f; 



mx/i 



X Ff^™ that satisfies ^-^ for some U C 



{1, . . . , n} is said to be a reduction of the matrix y. 



Remark I: It would be enough to specify, besides the matrix r, only the column space of L and the 
row space of E in the definition of a reduction. For simplicity we will, however, not use this notation 
here. 

Note that if y is a lifting of r, then (r, [], []) is a reduction of Y (where [] denotes an empty matrix). 
Thus, reduction can be interpreted as the inverse of lifting. 
We can now prove the main theorem of this section. 

Theorem 9: Let {r,L,E) be a reduction of Y. Then 

L r — X 



ds{{X),{Y)) = 2rank 







E 



{fi + 6). 



Proof: See the Appendix. ■ 

A consequence of Theorem |9] is that, under the lifting construction, the decoding problem (fTSl ) for 
random network coding can be abstracted to a generalized decoding problem for rank-metric codes. More 
precisely, if we cascade an RLNCC, at the input, with a device that takes x to its lifting X = I x 
and, at the output, with a device that takes Y to its reduction (r, L, E), then the decoding problem ([18 
reduces to the following problem: 



"^"^ be a rank-metric code. Given 



Generalized Decoding Problem for Rank-Metric Codes: LetC C F 

a received tuple (r, L, E) G F^^™ x F,""^ x F^^™ with rank L = n and rank E = 5, find 



X = argmin rank 
xec 



L r — X 

E 



(28) 



The problem above will be referred to as the generalized decoding problem for rank-metric codes, or 
generalized rank decoding for short. Note that the conventional rank decoding problem (O corresponds 
to the special case where fi = 6 = 0. 

The remainder of this paper is devoted to the study of the generalized rank decoding problem and to 
its solution in the case of MRD codes. 
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V. A Generalized Decoding Problem for Rank-Metric Codes 

In this section, we develop a perspective on the generaUzed rank decoding problem that will prove 
useful to the understanding of the correction capability of rank-metric codes, as well as to the formulation 
of an efficient decoding algorithm. 

A. Error Locations and Error Values 

Let C € ip"x»" be a rank-metric code. For a transmitted codeword x and a received word r, define 
e = r — a; as the error word. 

Note that if an error word e has rank r, then we can write e = LE for some full-rank matrices L G F^ ^"^ 
and E G FJ^'™, as in ©■ Let Li, . . . , L^ G F^ denote the columns of L and let Ei,...,Er G F^^^"" 
denote the rows of E. Then we can expand e as a summation of outer products 

T 

e = LE = J2LjEj- (29) 

We will now borrow some terminology from classical coding theory. Recall that an error vector e G F" 
of Hamming weight r can be expanded uniquely as a sum of products 

T 

where 1 < ii < • • • < v < n and ei, . . . , e,- G Fg. The index ij (or the unit vector li.) specifies the 
location of the jth error, while Cj specifies the value of the jth error. 

Analogously, in the sum-of-outer-products expansion (|29l ) we will refer to Li,...,Lr as the error 
locations and to Ei, . . . ,Er as the error values. The location Lj (a column vector) indicates that, for 
i = 1, . . . ,n, the jth error value Ej (a row vector) occurred in row i multiplied by the coefficient Lij. 
Of course, Lij = means that the jth error value is not present in row i. 

Note that, in contrast to the classical case, the distinction between error locations and error values in 
the rank metric is merely a convention. If we prefer to think of errors as occurring on columns rather 
than rows, then the roles of Lj and Ej would be interchanged. The same observation will also apply to 
any concept derived from the interpretation of these quantities as error locations and error values. 

It is important to mention that, in contrast with classical coding theory, the expansion ( [291 ) is not 
unique, since 

e = LE = LT-^TE 

for any nonsingular T G F^^^. Thus, strictly speaking, Li, . . . ,Lr and Ei, . . . ,Er are just one possible 
set of error locations/values describing the error word e. 
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B. Erasures and Deviations 

We now reformulate the generalized rank decoding problem in a way that facilitates its understanding 
and solution. 

First, observe that the problem (l28l) is equivalent to the problem of finding an error word e, given by 

L e 
E 
from which the output of the decoder can be computed as £ = r — e. 



e = argmin rank 

eer-C 



(30) 



Proposition 10: Let e € F^^™, L € Fg^^ and £^ e F^^". The following statements are equivalent: 

L 

1) r* = rank 

E 

2) r* — /u — 5 is the minimum value of 



rank(e-L^(i) -L^^^E) 



for all ^(1) e F^""" and all L^^) g F^^^ 
3) r* is the minimum value of r for which there exist Li, 
satisfying: 

T 



.,L^ e F" and Ei,...,Er G F, 



Ixm 



L,- = L 



J' 



^, 



M+i 



E. 



'J' 



,5. 



Proof: See the Appendix. ■ 

With the help of Proposition [TOl the influence of L and E in the decoding problem can be interpreted 
as follows. Suppose e £ r — Cis the unique solution to (l30l ). Then e can be expanded as e = Yl]=i ^j^j^ 
where Li, . . . , L^ and -E^+i, • • • , £'/i+<5 are known to the decoder. In other words, the decoding problem 
is facilitated, since the decoder has side information about the expansion of e. 

Recall the terminology of Section IV-AI Observe that, for j € {l,...,fi}, the decoder knows the 
location of the jth error term but not its value, while for j € {fi+ 1, . . . , fi + 6}, the decoder knows the 
value of the jth error term but not its location. Since in classical coding theory knowledge of an error 
location but not its value corresponds to an erasure, we will adopt a similar terminology here. However 
we will need to introduce a new term to handle the case where the value of an error is known, but not 
its location. In the expansion (|29l ) of the error word, each term LjEj will be called 
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• an erasure, if Lj is known; 

• a deviation, if Ej is known; and 

• a ^/Z error (or simply an error), if neither Lj nor E'j are known. 

Collectively, erasures, deviations and eiTors will be referred to as "errata." We say that an en^ata pattern 
is correctable when ( |28l) has a unique solution equal to the original transmitted codeword. 

The following theorem characterizes the errata-correction capability of rank-metric codes. 

Theorem 11: A rank-metric code C C ]p™x»" of minimum distance d is able to correct every pattern 
of e errors, ji erasures and 5 deviations if and only if 2e + /x + 5 < d — 1. 

Proof: Let a; € C be a transmitted codeword and let {r,L,E) e F^^™ x F,""^ x F^^™ be a 

L r — X 

fi + 5 + e. Suppose a;' G C is another codeword such that 



received tuple such that rank 



rank 



L r — x' 

E 



E 
fj. + 6 + e', where e' < e. From Proposition \T0\ we can write 

e = r-x = LE^^^ + L^'^^E + L^^^E^^^ 
for some E^^^ , L^^^ , . . . , E^^^ with appropriate dimensions such that rank L^^^E^^^ = e and rank L^^^E^^^ 



e'. 



Thus, 



and 



e-e' = L(i5(i) - i^(4)) + (l(2) - L^^))E + L^^^E^^^ + L^^^E^^^ 



rank(a;' — x) = rank(e — e') <fi + 6 + e + e'<d— 1 



contradicting the minimum distance of the code. 

Conversely, let a;, a;' e C be two codewords such that rank(a;' — a;) = d. For all /z, 5 and e such that 
fi + 6 + 2e > d, we can write 

a;' - a^ = L(^)i^(i) + L(2)i?(2) + L(3)i?(3) + ^^i^^^) 

where the four terms above have inner dimensions equal to /x, 5, e and e' = d — n — 5 — e, respectively. 
Let 

e' = -L(4)^(4) 
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and observe that x' — x = e — e' . Let r = x + e = x' + e',L = L^^^ and E = E^'^\ Suppose that x is 
transmitted and the tuple {r,L,E) is received. Then 



rank 



rank 



L r — X 

E 

L r — x' 

E 





L 


e 


= rank 











E 





L 


e' 


= rank 











E 



H + S + e 



fi + S + e'. 



Since e' = (i — ^ — 5 — e<e, it follows that x cannot be the unique solution to (l28l ) and therefore the 
errata pattern cannot be corrected. ■ 

Theorem [TT] shows that, similarly to erasures in the Hamming metric, erasures and deviations cost half 
of an error in the rank metric. 

Theorem [TT] also shows that taking into account information about erasures and deviations (when they 
occur) can strictly increase the error correction capability of a rank-metric code. Indeed, suppose that an 
error word of rank t = fi + 6 + e is applied to a codeword, where /U, 6 and e are the number of erasures, 
deviations and full errors, respectively, in the errata pattern. It follows that a conventional rank decoder 
(which ignores the information about erasures and deviations) can only guarantee successful decoding if 
2t < d — 1, where d is the minimum rank distance of the code. On the other hand, a generalized rank 
decoder requires only 2e + fi + 6 < d—l, or 2t < d—l + fi + 6, in order to guarantee successful decoding. 
In this case, the error correction capability is increased by {fi + 6)/2 if a generahzed rank decoder is 
used instead of a conventional one. 

We conclude this section by comparing our generalized decoding problem with previous decoding 
problems proposed for rank-metric codes. 

There has been a significant amount of research on the problem of correcting rank errors in the presence 
of "row and column erasures" [13], [15]-[18], where a row erasure means that all entries of that row are 
replaced by an erasure symbol, and similarly for a column erasure. The decoding problem in this setting 
is naturally defined as finding a codeword such that, when the erased entries in the received word are 
replaced by those of the codeword, the difference between this new matrix and the codeword has the 
smallest possible rank. We now show that this problem is a special case of ([28l) . 

First, we force the received word r to be in F"^*" by replacing each erasure symbol with an arbitrary 
symbol in Wg, say 0. Suppose that the rows ii, . . . ,i^ and the columns ki, . . . ,ks have been erased. Let 
L € Wg""^ be given by Li^j = 1 and Lij = 0, Vi / ij, for j = 1, . . . , f^i and let E G F^^™ be given by 
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Ej^kj = 1 and E- 



•i,k 



0, V/c / kj, for j = 1, . . . , 5. Since 



L 


r — X 




L r 




a; 





E 




E 








(31) 



it is easy to see that we can perform column operations on (1311 ) to replace the erased rows of r with the 
same entries as x, and similarly we can perform row operations on (|3TI ) to replace the erased columns of 
r with the same entries as x. The decoding problem (1281 ) is unchanged by these operations and reduces 
exactly to the decoding problem with "row and column erasures" described in the previous paragraph. 
An example is given below. 



Example 4: Let n 
received word. Then 



?n 



3. Suppose the third row and the second column have been erased in the 



r\\ 


ri3 


^21 


r23 









L 



E 



1 



Since 

rii ri3 

r2i r23 

10 

10 
are row equivalent, we obtain that 



and 



rii xx2 ri3 

r2l 3;22 ?'23 

1 X31 3:32 X33 
10 



rank 



L 


r — X 







E 


= rank 



rii - xii ri3 - 2:13 

r2i - X21 r23 - X23 

10 

10 

m - 2;ii ri3 - xi3 
2 + rank r2i - X21 r23 - X23 


which is essentially the same objective function as in the decoding problem with "row and column 
erasures" described above. ■ 

While row/column erasures are a special case of erasures/deviations, it also true that the latter can 
always be transformed into the former. This can be accomplished by multiplying all rank-metric codewords 
to the left and to the right by nonsingular matrices in such a way that the corresponding Lj and Ej become 
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unit vectors. The drawback of this approach, as pointed out in Section IIV-BI is that the structure of the 
code is changed at each decoding instance, which may raise complexity and/or implementation issues. 
Thus, it is practically more advantageous to fix the structure of the code and construct a decoder that 
can handle the generalized notions of erasures and deviations. This is the approach we take in the next 
section. 

VI. Decoding Gabidulin Codes with Errors, Erasures and Deviations 

In this section, we turn our attention to the design of an efficient rank decoder that can correct any 
pattern of e errors, fi erasures and 6 deviations satisfying 2e + n + 6<d — 1, where d is the minimum 
rank distance of the code. Our decoder is applicable to Gabidulin codes, a class of MRD codes proposed 
in [11]. 



A. Preliminaries 

Rank-metric codes in F"^™ are typically constructed as block codes of length n over the extension 
field ¥q<r^. More precisely, by fixing a basis for F^™ as an ?n-dimensional vector space over Fg, we 
can regard any element of ¥gn^ as a row vector of length m over ¥q (and vice-versa). Similarly, we can 
regard any column vector of length ?i over F^™ as an ?i x m matrix over ¥q (and vice-versa). All concepts 
previously defined for matrices in F^'^™ can be naturally applied to vectors in F"™; in particular, the 
rank of a vector x € F^™ is the rank of a; as an n x tti matrix over F^. 

1) Gabidulin Codes: In order to simplify notation, let [i] denote q'\ A Gabidulin code is a linear (n, k) 
code over F^m defined by the parity-check matrix 



H 






2 

[1] 



"-n 



[n-fc-1] ,[n-fc-l] ,[n-fc-l] 

where the elements hi, . . . ,hn G ¥gm are linearly independent over ¥q (note that n < tti is required). 
The minimum rank distance of a Gabidulin code is d = n — k + 1, satisfying the Singleton bound in the 
rank metric [11]. 

2) Linearized Polynomials: A class of polynomials that play an important role in the study of rank- 
metric codes are the linearized polynomials [25, Sec. 3.4]. A linearized polynomial (or g-polynomial) 

over ¥q,7^ is a polynomial of the form 

t 

1=0 
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where /j € Fg^. If ft ^ 0, we call t the (/-degree of f{x). Linearized polynomials receive their name 
because of the following property: for any ai,a2 G Fg and any /3i,/32 G F^™, 

/(ai/3i + a2/32) = «i/(/3i) + a2/(/32). 

That is, evaluation of a linearized polynomial is a map F^™ ^ F^™ that is linear- over ¥q. In particular, 
the set of all roots in F^m of a linearized polynomial is a subspace of F^™ . 

Let A{x) and i?(a;) be linearized polynomials of (/-degrees Ia and ts, respectively. The symbolic 
product of ^4(2;) and B{x) is defined as the polynomial A{x) (g) B{x) = A{B{x)). It is easy to verify 
that P{x) = A{x) ® B{x) is a linearized polynomial of (/-degree t = tA + tB whose coefficients can be 
computed as 

irLin{^,t4} min{£,tB} 

i=max{0,^— is} j=max{0/— (a} 

for £ = 0, . . . , i. In particular, if tA < ^s, then 

tA 

P, = Y,A^Bf_,, tA<i<tB, (32) 

while if tB <tA, then 

Pt = Y, Ae-jBf~^^ , tB<£<tA. (33) 

i=o 

It is known that the set of linearized polynomials over F^^ together with the operations of polynomial 
addition and symbolic multiplication forms a noncommutative ring with identity having many of the 
properties of a Euclidean domain. 

We define the q-reverse of a linearized polynomial f{x) = Yl,i=Q fi^ ^^ the polynomial /(x) = 
Sj=o li^ given by /j = f\''_^ for i = 0, . . . , t. (When t is not specified we will assume that t is the 
qi-degree of f{x).) 

For a set 5 C F^™, define the minimal linearized polynomial of S (with respect to F^™), denoted 
Ms{x) or minpoly{5}(a;), as the monic linearized polynomial over ¥qm of least degree whose root 
space contains S. It can be shown that Ms{x) is given by 

Ms{x)^ \{{x-P) 

so the (/-degree of Ms{x) is equal to dim {S). Moreover, if f{x) is any linearized polynomial whose 
root space contains S, then 

f{x) = Qix)(dMsix) 



28 

for some linearized polynomial Q{x). This implies that Mgij^^jix) = ^iMs{a){x) (8) Ms{x) for any a. 
Thus, Ms{x) can be computed in 0{t^) operations in F^™ by taking a basis {ai, . . . , 04} for {S) and 
computing Afr^^ ^^ j (j;) recursively for f = 1, . . . , t. 

3) Decoding of Gabidulin Codes: Recall that, in the conventional rank decoding problem with r 
errors, where 2r < d — 1, we are given a received word r € F^^ and we want to find the unique error 
word e e r — C such that rank e = r. We review below the usual decoding procedure, which consists of 
finding error values Ei, . . . ,Er G F^™ and error locations Li, . . . , L,- G F" such that e = Yl'^j=i ^j^j- 

Since e G r — C, we can form the syndromes 

[So,...,Sd-2f^Hr = He 
which can then be related to the error values and error locations according to 

n n T 

T 

= Y.^f^i^ ^ = 0,...,d-2 (34) 

where 

n 

Xj = ^Lijhi, j = l,...,T (35) 

are called the error locators associated with Li, . . . , L^-. 

Suppose, for now, that the error values Ei,...,Er (which are essentially r linearly independent 
elements satisfying (e) = {Ei, . . . ,Er)) have already been determined. Then the error locators can 
be determined by solving (l34l ) or, equivalently, by solving 

^^ = C2-? = E^r'^'^^.' ^ = 0,...,d-2 (36) 

which is a system of equations of the form 

T 

Be = Y,AfXj, £ = 0,...,d-2 (37) 

consisting oi d — 1 linear equations (over F^™) in r unknowns Xi, . . . , Xr- Such a system is known to 
have a unique solution (whenever one exists) provided t < d—1 and Ai, . . . ,Ar are linearly independent 
(see [25], [26]). Moreover, a solution to (l37l ) can be found efficiently in 0{d'^) operations in Fq^ by an 
algorithm proposed by Gabidulin [11, pp. 9-10]. 
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After the error locators have been found, the error locations Li, . . . ,Lr can be easily recovered by 



solving (l35l ). More precisely, let h € F^^™ be the matrix whose rows are hi, ... , hn, and let Q S F™^" 
be a right inverse of h, i.e., hQ = Inxn- Then 

m 

Lij = y ^ XjkQki, i = 1, . . . ,n, j = 1, . . . ,T. 

fc=i 

The computation of error values can be done indirectly via an error span polynomial a{x). Let a{x) 
be a linearized polynomial of (^-degree r having as roots all linear combinations of £'i, ... ,£■,-. Then, 
(t(x) can be related to the syndrome polynomial 

d-2 

S{x) = ^ Sf 

j=0 

through the following key equation: 



^-x^l 



a 



(x) (g) S{x) = Lo{x) mod xl'^-^1 (38) 



where u!{x) is a linearized polynomial of g-degree < r — 1. 
An equivalent way to express (1381 ) is 



Y^a,sf[^ = 0, i = T,...,d-2. (39) 

1=0 

This key equation can be efficiently solved in 0{d^) operations in F^m by the modified Berlekamp- 
Massey algorithm proposed in [13], provided 2r < d — 1. 

After the error span polynomial is found, the error values can be obtained by computing a basis 
El, . . . ,Er for the root space of a{x). This can be done either by the probabilistic algorithm in [27], in 
an average of 0{dm) operations in F^m, or by the methods in [28], which take at most 0{m?) operations 
in ¥q plus 0{dm) operations in F^™. 

B. A Modified Key Equation Incorporating Erasures and Deviations 

In the general rank decoding problem with e errors, /x erasures and 6 deviations, where 2e+fi+6 < d— 1, 
we are given a received tuple {r,L,E) G F"™ x F^ ^'^ x F^,„ and we want to find the unique error word 



e £ r — C such that rank 



L e 

E 



e + /i + (5 = r (along with the value of e, which is not known a 



priori). 

First, note that if we can find a linearized polynomial a{x) of g-degree at most t < d — 1 satisfying 
a{ei) = 0, i = I, . . . ,n, then the eiTor word can be determined in the same manner as in Section rVI-A3l 
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According to Proposition [TOl we can write the error word as e = ^^^^^ ^j^j for some Li, . . . ,Lr € Fg 
and El, . . . ,Er G F^™ satisfying Lj = Lj, j = 1, . . . ,fi, and -E/^+j = Ej, j = 1,. . . ,5. Let aoix), 
(Tf{x) and auix) be linearized polynomials of smallest (/-degrees satisfying 

aD{Ej) = 0, j = fi + l,...,fi + 5 
aF{(7D{Ej)) = 0, j = fj. + 5+l,...,T 
au{crF{aD{Ej))) =0, j = 1, . . . , jj. 

Clearly, the Q'-degrees of aoix) and apix) are 6 and e, respectively, and the g-degree of au{x) is at 
most jj,. 

Define the error span polynomial 

a{x) = cru{x) (g) apix) (g) aoix). 

Then a{x) is a linearized polynomial of g-degree < r satisfying 

T T 

a{ei) = o-(^ LijEj) = ^ Lija{Ej) = 0, i = 1, . . . , n. 
j=i i=i 

Thus, since a^ix) can be readily determined from E, decoding reduces to the determination of (Jf{x) 

and au{x). 

Now, let Xu{x) be a linearized polynomial of (/-degree fi satisfying 

and let A{/(x) be the g-reverse of Xij{x). We define an auxiliary syndrome polynomial as 

Sdu{x) = o-d{x) <8) ^(a;) (g) Xu{x). 

Observe that Sdu{x) incorporates all the information that is known at the decoder, including erasures 
and deviations. 

Our modified key equation is given in the following theorem. 

Theorem 12: 

apix) (g) Sdu{x) = uj{x) mod x^'^-^l (40) 

where u){x) is a linearized polynomial of g-degree < r — 1. 

Proof: Let uj{x) = apix) (g Souix) mod x^'^"'^^ If r > (i — 1, we have nothing to prove, so let us 
assume t < d — 2. We will show that w^ = for ^ = r, . . . , li — 2. 
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Let apoix) = aF{x)®aD{x) and Sfd{x) = apj:,{x)0S{x). According to (l32l) . for e + 6 < i < d — 2 
we have 

e+5 e+5 / T 

SfD,£ = ^(TFD,^SP_i = ^(TFD,i ^Xf~'^Ej 

i=0 i=0 \j=l 

= ±xfaFo{E,) = ±xfp„ (41) 



where 



Pj = (Tfd{Ej), j = l,...,//. 



Note that ^^(x) Sdu{x) = Sfd{x) Xu{x)- Using ^3^ and (SB, for/i + e + 5<^<d-2we 
have 

i=0 i=0 j=l 

j=l i=0 i=l 

This completes the proof of the theorem. ■ 

The key equation can be equivalently expressed as 

Y.''pA,i-i = ^^ i = ^^ + S + e,...,d-2. (42) 

Note that this key equation reduces to the original key equation (1381 ) when there are no erasures or 
deviations. Moreover, it can be solved by the same methods as the original key equation (l38l ). e.g., 
using the Euclidean algorithm for linearized polynomials [11] or using the modified Berlekamp-Massey 
algorithm from [13], provided 2e<d — 1 — fi — 5 (which is true by assumption). Note that a small 
adjustment needs to be made so that (l42l ) becomes indeed equivalent to ( |39l ); namely, we should choose 
Se in (|39l ) as Se = SDU,e+^l+5 and replace d with d — fi — 6. 

After computing apix), we still need to determine au{x). In the proof of Theorem [121 observe 
that (|4TI ) has the same form as (l37l) : thus, /3i,...,/3^ can be computed using Gabidulin's algorithm 
[11, pp. 9-10], since SFoix) and Xi, . . . ,X^ are known. Finally, ctu{x) can be obtained as au{x) = 
minpoly{/3i,...,/3^}. 

C. Summary of the Algorithm and Complexity Analysis 

The complete algorithm for decoding Gabidulin codes with erasures and deviations is summarized in 
Fig. [T] We now estimate the complexity of this algorithm. 
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Input: received tuple {r,L,E) G F'^L x Fg""^ x F^™. 
Output: error word e G F^„. 

1) Computing the auxiliary syndrome polynomial: 
Compute 

a) 5, = x:r=i^F'^-^ = o,...,d-2 

b) ^i = Er=i ^ij^i' i = 1, • • • > /^ 

c) A(7(x) = minpoly{Xi,...,X^} 

d) (J£,{x) = minpoly{£'i, . . . ,Es}, and 

e) 5'd;7(x) = (7d(x) (g) S'(x) ® Ac/(x). 

2) Computing the error span polynomial: 

a) Use the Berlekamp-Massey algorithm [13] to find (Jf{x) that solve the key equation ( |40l ). 

b) Compute Sfd{x) = apix) ® (yoix) S{x). 

c) Use Gabidulin's algorithm [11] to find /?i, . . . ,/?^ G F^-r. that solve (ITO . 

d) Compute (7f/(x) = minpoly{/3i, . . . ,/3^} and 

e) a{x) = au{x) ® aF{x) (^ cF]:,{x). 

3) Finding the roots of the error span polynomial: 

Use either the algorithm in [27] or the methods in [28] to find a basis Ei, . . . ,Er G F^™ for the 
root space of a{x). 

4) Finding the error locations: 

a) Solve (l36l ) using Gabidulin's algorithm [11] to find the error locators Xi, . . . ,Xr G F^™. 

b) Compute the error locations Lij = Y^^=i ^jkQki^ i = I, . . . ,n, j = 1, . . . ,t. 

c) Compute the error word e = Yl]=i ^j-^j- 

Fig. 1. Generalized decoding algoritlim for Gabidulin codes. 

Steps [Tel). |2bl) and|2e]) are symbolic multiplications of linearized polynomials and can be performed in 
0{d'^) operations in ¥qm. Steps [Tel). fTdl) and[2db involve finding a minimal linearized polynomial, which 
takes 0{d'^) operations in F^™. Steps [TBI). l4bl ) and |4cl) are matrix multiplications and take 0{dnm) 
operations in Fg only. Both instances |2c]) and |4al) of Gabidulin's algorithm and also the Berlekamp- 
Massey algorithm in step|2al) take O(d^) operations in F^™. 
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The most computationally demanding steps are [Ta]) computing the syndromes and [3]) finding a basis 
for the root space of the error span polynomial. The former can be implemented in a straightforward 
manner using 0{dn) operations in F^m, while the latter can be performed using an average of 0{dm) 
operations in F^™ with the algorithm in [27] (although the method described in [28] will usually perform 
faster when m is small). 

We conclude that the overall complexity of the algorithm is 0{dm) operations in F^™. 

D. An Equivalent Formulation Based on the Error Locator Polynomial 

Due to the perfect duality between error values and error locators (both are elements of F^™), it is 
also possible to derive a decoding algorithm based on an error locator polynomial that contains all the 
error locators as roots. 

Let the auxiliary syndrome polynomial be defined as 

Sud{x) = \u{x) ® S{x) ® aB(x['^-2])M+2] 

where (J£){x) is the g-reverse of aoix) and S{x) is the g-reverse of S{x). 

Let Xf{x) be a linearized polynomial of g'-degree e such that XpiXui^i)) = 0, for i = fi+6+1, . . . , r. 
We have the following key equation: 

Theorem 13: 

Xf{x) ® Sud{x) = 4^{x) mod xl'^-^l (43) 

where Tp{x) is a linearized polynomial of g-degree < r — 1. 

Proof: The proof is similar to that of Theorem [12] and will be omitted. ■ 

The complete decoding algorithm based on the error locator polynomial is given in Fig. |2l 

E. Practical Considerations 

We have seen that the complexity of decoding a Gabidulin code C C ]p"X"i vvith dB,{C) = d is given 
by 0{dm) operations in F^m. In many applications, in particular for network coding, we have m ^ n. 
In such cases, the decoding complexity can be significantly reduced by using, rather than a Gabidulin 
code, an MRD code formed by the Cartesian product of many shorter Gabidulin codes with the same 
distance. More precisely, let i = [—J and n' = m — n{i — 1). Take C = Ci x C2 x • • • x Ci, where 
Ci ^F^^", i = 1, ...,£— 1, and Ci C F^><" are Gabidulin codes with minimum rank distance d. Then 
C is an MRD code with ^(C) = d. 
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Input: received tuple {r,L,E) € F'^^. x Fg""^ x F^„. 
Output: error word e G F"„. 

1) Computing the auxiliary syndrome polynomial: 
Compute 

a) St = Tri=ihfri,l = Q,...,d-2 

b) ^j = Yh=i Lijhi, j = l,...,fj. 

c) Ac/(x) = minpoly{Xi,...,X^} 

d) (7d{x) = minpoly{£'i, . . . , Es}, and 

e) Sud{x) = Xu{x) (g) Six) ® aD(x['^-2])M+2]_ 

2) Computing the error locator polynomial: 

a) Use the Berlekamp-Massey algorithm [13] to find \f{x) that solve the key equation (|43] ). 

b) Compute Sfu{x) = Xf{x) ® Xu{x) <S> S{x). 

c) Use Gabidulin's algorithm [11] to find 71, ... ,75 G Fgn. that solve 

5 

Sfu,i = 2^EI^+j 'ir 

d) Compute Az)(x) = minpoly{7i, . . . ,75} and 

e) \(x) = \f){x)®\f{x)®\ij{x). 

3) Finding the roots of the error locator polynomial: 

Use either the algorithm in [27] or the methods in [28] to find a basis Xi, . . . , Xj- G F^™ for the 
root space of X{x). 

4) Finding the error values: 

a) Solve (l34l ) using Gabidulin's algorithm [11] to find the error values Ei,. . . ,Ej- G F^™. 

b) Compute the error locations Lij = Yl^=i ^jkQku i = I, ■ ■ ■ ,n, j = 1, . . . ,t. 

c) Compute the error word e = J2]=i ^j^j- 

Fig. 2. Generalized decoding algoritlim for Gabidulin codes, alternative formulation. 
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Now, decoding of C can be performed by decoding each Ci individually. Thus, assuming for simplicity 
that m = ni, the overall decoding complexity is given by iO{dn) = 0{dm) operations in ¥qr^. In other 
words, operations in a potentially large field F^™ can be replaced by operations in a much smaller field 

Note that, in this case, additional computational savings may be obtained, since all received words 
will share the same set of error locations. For instance, if all error locations are known and the decoding 
algorithm of Fig. |2]is used, then only steps la), lb) and 4a)-4c) need to be performed. 

VII. Conclusions 

In this paper, we have introduced a new approach to the problem of error control in random network 
coding. Our approach is based, on the one hand, on Kotter and Kschischang's abstraction of the problem 
as a coding-theoretic problem for subspaces and, on the other hand, on the existence of optimal and 
efficiently-decodable codes for the rank metric. We have shown that, when lifting is performed at the 
transmitter and reduction at the receiver, the random network coding channel behaves essentially as a 
matrix channel that introduces errors in the rank metric and may also supply partial information about 
these errors in the form of erasures and deviations. 

An important consequence of our results is that many of the tools developed for rank-metric codes can 
be almost directly apphed to random network coding. However, in order to fully exploit the correction 
capability of a rank-metric code, erasures and deviations must be taken into account. A second contribution 
of this work is the generalization of the decoding algorithm for Gabidulin codes in order to fulfill this 
task. Our proposed algorithm requires 0{dm) operations in F^™, achieving the same complexity as 
conventional decoding algorithms that only correct rank errors. 

Following this work, a natural step toward practical error control in random network coding is the 
pursuit of efficient software (and possibly hardware) implementations of encoders and decoders for 
GabiduUn codes. Another avenue would be the investigation of more general network coding scenarios 
where error and erasure correction might be useful; for example, the case of multiple heterogeneous 
receivers can be addressed using a priority encoding transmission scheme based on Gabidulin codes [29]. 
An exciting open question, paralleling the development of Reed-Solomon codes, is whether an efficient 
list-decoder for Gabidulin codes exists that would allow correction of errors above the error-correction 
bound. 

We believe that, with respect to forward error (and erasure) correction, Gabidulin codes will play the 
same role in random network coding that Reed-Solomon codes have played in traditional communication 



36 

systems. 
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Appendix 

A. Proof of Proposition [7| 

Before proving Proposition |2l let us recall some properties of the matrices In and Iw, where / = Inxn, 
U Q {1, . . . ,n} and W^ = {1, . . . ,n} \ U. 

For any A G F^x'^ (respectively, A € F^^"), the matrix I^A (resp., Aly) extracts the rows (resp., 

7/1 ^ ^ ky.\lA\ 

columns) of A that are indexed by U. Conversely, for any B € Fg (resp., B ^¥q ) the matrix lyB 
(resp., BI^) reallocates the rows (resp., columns) of B to the positions indexed by U, where all-zero 
rows (resp., columns) are inserted at the positions indexed by W. Furthermore, observe that Ik and Iu<^ 
satisfy the following properties: 

rp 

^U^U = I\U\x\U\ 

lulu^ = 0. 

We now give a proof of Proposition |7] 

Proof of Proposition^ Let RRE(y) denote the reduced row echelon form of Y . For i = \, . . . ,N, 
let Pi be the column position of the leading entry of row i in RRE(y). Let U^ = {pi, . . . ,p„__^} and 
^ = {1, . . . , n} \ W. Note that \U\ = p. From the properties of the reduced row echelon form, we can 

write 

V f 
RRE(y) 

E 
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where f G fJ" ''^''"', ^ E F^^"^ has rank 6, and W G fJ" ''^''" satisfies WIu^ = /(„_^)x(n-/.)- 



Now, let 



Y 



lu^ 

hx& 



RRE(y) 



lu^W r 
E 



where r = Iw^r- Since / = lu'Iu" + ^u^U' ^^ '^^^^ 



Iu^W = Iu^W{Iu^ll,.+IuIi 



u, 



I-IulS + Iu^WIulS 



I + LL 



where L = —ly + Iw^WIu- Also, since lylu = I^lx^l and lylw = 0, we have I^L = —If^xfi. and 
/^r = 0. 
Thus, 



y 



I + LIS r 
^ 



is a matrix with the same row space as Y. The proof is complete. 

B. Proof of Proposition H] 

Proof of Proposition \8^ We want to show that 



/ + LTI^ r 
RE 



I + LIS r 

E 



From ([5]) and the fact that R is nonsingular (since rank RE = 6), this amounts to showing that 



I + LT/J r 



I + LI^ r 



Let VFi = / + L/j^ and W2 = I + LTIg . Note that, since Wilw = Iw and /^ 

that I^aWi is full rank. Similarly, /J VF2 r 

that 



T^i r 



0, we have 



and IgcW2 is full rank. Thus, it suffices to prove 



M 



W2 r 



Wi r 



(44) 



for some M G F^^". 
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Let A = U U S and B = U H S. Observe that M can be partitioned into three sub-matrices, MI^^c, 
Mis and MIu\b- Choose M/^c = I_a<^, and Mis arbitrarily. We will choose MIu\b so that (HUl is 
satisfied. First, note that 

Mr = MiU.ll. + Ull)r = I^.I^.r = r 

since I^r = 0. Thus, we just need to consider MW2 = Wi in (l44l ). Moreover, note that 

MW2 = M{Ia^iI. + Isll + Iu\bIu\bW2 



Ia^iIM2 + {MIu\s){Iu\bW2). 



Now, consider the system MW2 = Wi. From basic linear algebra, we can solve for MIy\js if and only 
if 



rank 



Wi - Ia^I^M2 



<\ll\B\ 



Since I^y^Wi = and /JW2 = 0, we can rearrange rows to obtain 



rank 



IS\bW2 
Wi-Ia^I^M2 



rank 



lIi\B^W, - W2) 
tT 



_ku\BYHu\ByXW,-W2)_ 
= rznk{Wi-W2). 
To complete the proof, we will show that rank(VKi — W2) < \IA\B\. We have 

rank(P^i - W2) = rank{LI^ - LTI^) 
<rank(/^j:-rij) 
= rank(/jL/eJ + /J) 
= rank /JWi 
= rank Isls^i 

= '^3nk{Is\Bls\B + IbIbWi 
= rank Is\bII\bWi 

<\S\B\ = \U\B\. 

where (|45] ) is obtained by left multiplying by IgL = —T~^. 



(45) 
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C. Proof of Theorem |9] 

Proof of Theorem ^ We have 



rank 



rank 



X 



rank 



I + LI^ r 

E 



-Liu ^-^ 

i + iq r 

E 



rank 



LIL 



r — X 

T\ tT 



1^1 + Lit,) I^r 
E 



where (1461) follows from /, 



u 



rank 



rank 



rank 



/ + L/^ r 



IIu 


r — X 




I^x 





E 



Liu ^-^ 







E 



+ rank 



lyc lyaX 



L r — X 

E 



+ n- n 



0, ( |48l ) follows by subtracting I^, 



(46) 



Liu r-^ 



(47) 



(48) 



(49) 



from 



and LiT.Iu': = (i.e., the two matrices 



/^.(/ + Llli) Ili^r\ , & follows from I^Ju^ = /(„_^)x{n-,.) — --^^ 
in (|48] ) have row spaces that intersect trivially), and ( |49l) follows by deleting the aU-zero columns. 
Since rank X + rank Y = 2n — fi + 6, we have 

^X 



dsi{X),{Y)) = 2rank 



2 rank 



Y 



rank X — rank Y 



L r — X 

E 



fi — 6. 



D. Proof of Proposition \W\ 

Before proving Proposition [TOl we need the following lemma. 
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Lemma 14: For X G F^^'" and Y G F^^™ we have 



min rank(y — AX) = rank 



and for X G F^^™ and y G F^'^^^ we have 



rank X 



min rankfy — XB) = rank 



X y 



rank X. 



Proof: For any A G F^^^", we have 



rank 



X 


= rank 


X 


Y 




Y -AX 



< rankX + rank(y-AX) 



which gives a lower bound on rank(y — AX). We now prove that this lower bound is achievable. 
Let Z G Ff ™ be such that {Y) = {X) n (Y) © (Z), where t = rank y - w and u; = dim {X) n (Y). 



Let B G F^^" be such that (BX) = {X) D (Y). We can write Y = T 



BX 

Z 



for some full-rank 



TgF, 



Ny.{u)+t) 



. Now, let A = T 



g ]pAfxm_ ^^^^ 



BX 


-T 


BX 


Z 










) 


= rank Z 


z 







rank(y- AX) = rank(r 



rank(T 



rank y- dim ((X)n(y)) 

X 
Y 
This proves the first statement. The second statement is just the transposed version of the first one. 

Proof of Proposition \W[ Let 



rank 



rank X. 



e'= min rankfe - L^^^) - L^^)^). 

B(1),L(2) 

We first show the equivalence of 1) and 2). From Lemma [T4l we have 



min rankfe - LS^^^ - L^^)^) = rank 

L(2) 



E 



rank E. 
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Similarly, from Lemma [14] we have 





e - 


- LEW 


min rank 






EW 




E 



min rank 

E(-i-) 



e(^) 



Thus, 



e' = rank 



rank 

L e 

E 



L e 

E 



rank L. 



fi — 6 



and the equivalence is shown. 

Now, observe that the statement in 3) is equivalent to the statement that t* — jj. — 6 is the minimum 
value of e for which there exist S^^) e F^""", L^^) g F^^^ L^^) e F^^^ and ^(3) g jpexm satisfying 

To show the equivalence of 2) and 3), we will show that e' = e", where 

e" = min e. 

We can rewrite e" as 



e = mm 



mm e 

e,L(3),E(3): 
e-LB(i)-L(2)£;=L(3)£;<3) 



min rank(e-L£;(^) -L(2)£;) 



(50) 



e'. 



where (l50l ) follows from ([Hi. This shows the equivalence between 2) and 3). 



